start	end	text
580	4060	Hi Voting Village. My name is Forrest Senti. I'm the Director of Business and Government Affairs
4060	8580	at the National Cyber Security Center. I'm Caleb Gardner. I'm a fellow at the National
8580	12380	Cyber Security Center and Secure the Vote. And we're going to be presenting you our
12380	16200	Hack-a-Fax presentation today. For a little background to start,
16980	22340	National Cyber Security Center is a 501c3 centered in Colorado Springs. A lot of our focus has to do
22340	27640	with cyber innovation awareness and a lot of our projects have to do with tackle global problems,
27640	33380	smart cities, elections, space. Some of our colleagues in the Space ISAC are presenting
33380	37340	today in the Aerospace Village. We want to give them good congratulations and a shout out over
37340	42260	there. But the big reason why we're here today ultimately is that we want to talk about the gap,
42760	47080	the security gap. And specifically it has to do with policy in addition to the different
47080	52500	agencies and groups. A lot of people ask why NCC? Why us? Why do we care about some of these issues?
52500	55800	And the reality is that between the different groups that exist in the United States that are
55800	60480	multi-agency, multi-party, multi-policy, you know, depending on where you come from,
60480	64740	whether it's the Election Security ISAC, groups like Verified Voting, MIT, even places like the
64740	70880	EIC, CISA, CIS, all serve a specific segment. But our focus is on identifying gaps in critical
70880	75280	infrastructure. And the presentation you're going to hear from us today is going to be talking about
75280	81380	that gap. One gap we've identified specifically has to do with the population affecting the
81380	87480	overseas voter or UOCAVA. This is specific to the Uniformed and Overseas Citizens Absentee Voting
87480	92460	Act. Many of you here at the Voting Village, it's going to be no secret and surprise to you.
92540	95820	You know what this means. You know how many people and, you know, kind of the different
95820	100280	challenges these people face, whether they're voting from Afghanistan or Italy or even from a
100280	106520	remote jungle, the Amazon. So a lot of what we're focused on today is on this area.
106520	110480	So one of the pieces I want to call out is specific to fax machines, like we mentioned
110480	115340	early on. Under the current implementation of the Move Act that was established in 2009,
115340	122100	31 states currently allow for ballot return via email and fax. This means that these 31 states
122100	126320	have to provide a place for these people that are voting from overseas to provide
127420	131520	a place for them to send their ballot via fax or email. So knowing this information
131520	135940	and us seeing this different research that was coming out, we wanted to do a quick breakdown
135940	142720	and see how many ballots were actually transmitted back in 2018. According to the EAC, roughly 29,000
142720	147820	ballots were sent. Now, this is under the category of others. So some of these in there could be
147820	152100	mobile voting from West Virginia or a web portal like in Colorado, Montana, Arizona, or Michigan.
152860	157260	But 29,000 ballots, although not statistically significant to the rest of the United States,
157260	162540	still represents a population that is voting using this method. And this shows that election
162540	167460	offices are still allowing for this method and pushing for it, even in some cases. Although it
167460	171720	has been on the decline, it's important to note that security is still paramount for every single
171720	175500	vote that comes out. So now I'll hand it over to Caleb, who's going to talk a little more about
175500	180320	the research that we did specific to fax machines and election jurisdictions and kind of give you
180380	185040	a little more of the issue right now. Thanks, Forrest. So first off, we're going to reference
185040	190220	you guys back to some presentations that probably made an impression on you when you first saw them.
190220	195660	They were specifically focused on fax and printer faxes. So first off, in DEFCON 26, we saw lots of
195660	200840	fax from checkpoint research. And that was a big sticking point for me. And we came back to that a
200840	205960	lot as we went to do our own research and talk to other counties and cities. So we'll move to the
205960	211880	next slide. And what checkpoint research really showed us was that it was impossible to exploit
211880	218120	printer fax just with a publicly available fax number. No city or county that I looked for,
218120	222440	their fax number was not available. Every single time I could find it for the city clerk or the
222440	225760	county clerk, and which is where you'd be submitting your vote for if you were one of these
225760	232320	blue collar voters. So using that phone number, checkpoint research was able to hack printer fax.
232320	236880	And actually, they were also able to get to the network behind that printer fax if there was a
236880	241800	flat network topology with no segmentation. So we'll talk about how they did that really fast.
241800	247460	They discovered that in the T30 protocol, we have access to both the data and the headers.
247460	252160	This enabled us to have full control of the JPEG file. So that's why we use JPEG over any other file
252160	257920	type. And over the PSTN networks, the publicly switched telephone network, we are able to get
257920	264460	to that printer fax and use the proprietary JPEG parser. They specifically looked at HP, but this
264460	269240	is probably going to be the case for any of the big solutions. If that's Xerox, if that's HP, if
269240	273000	that's someone else, they're probably implementing their own JPEG parser rather than using some sort
273000	279200	of open source publicly known secure parser. So since they did that themselves, they found a lot
279200	284080	of CVEs in there. They found a buffer overflow with parts and gauge T-markers. And with that,
284080	287960	they had a controllable stack-based overflow. They could do anything with it, and they were able to
287960	292820	get a great exploit, which they put on eternal blue to the rest of the network. And so it was
292880	298860	a really great demonstration in DEF CON 26. What could you do with this? A lot. Practically
298860	302660	everything. You have confidentiality attacks, integrity attacks, and availability attacks. You
302660	307880	have a full CIA triad. You're seeing voter registration info, particularly if you're
307880	312420	getting through to the network behind these printed faxes. You're seeing ballots, hopefully
312420	319440	not, but potentially. And you are able to maybe change those ballots. That's something that we're
319440	322860	going to look at in the future, is if we can get into one of these printed faxes, can we get to
322860	327460	those ballots, or can we get the incoming ballots and change them before they're stored? And also
327460	332060	you have availability attacks. You're potentially able to bring down an entire city or county's
332060	336720	infrastructure for receiving votes for that election, which would make a recount necessary,
336720	340180	which would make a lot of bad things happen. Obviously, we don't want to be saying.
340880	343600	So we're going to research. We did some confidential research with different cities and
343600	348840	counties, and we have to keep that confidential. We are under NDA, but we can generalize. We can
348840	354560	say what are the rough takeaways we're seeing from two main different types of cities. First off,
354560	358940	we have City A. This is your medium to large size city. They probably have good infrastructure
358940	363560	investment in IT. They're probably able to actually hire talented IT professionals who
363560	367420	are security conscious, and they're able to enforce strict adherence to best practices
367420	371620	with regards to security. These are all great things, and you're probably going to see a pretty
371620	378100	secure printed fax implementation. We did when we were looking at these types of cities. City B,
378100	383000	however, is the city that we talk about pretty much every time DEF CON rolls around with Voting
383000	388180	Village. They're the ones who are still running the DREs that we have shown vulnerabilities in
388180	391800	every year. You know, it's obviously a broken system that they're still implementing,
391800	394520	but they're not going to spend the money to fix it. They're not going to spend any money to
394520	399540	become security conscious. So probably a really poor mismanaged IT department,
399540	402920	and they probably don't have good patching policies or security posture.
404560	409000	So looking at City A in more in-depth, the things that they have that makes them stand apart from
409000	413800	other cities is that they have usually segmented networks. This keeps their printer fax separate
413800	418080	from their data servers. It keeps them separate from their employee workstations, and it's even
418080	423240	segmented on a very in-depth level. So every fire station and police station, there would be those
423240	426820	three things, the data servers, the workstations, and the print servers, would all be different
426820	431020	things in every single location. So it's an extremely segmented network that keeps you from
431020	436140	getting to a lot of access through that one printer fax. So basically City A knows that
436140	440160	printer fax is a potential point of intrusion. They probably have good patching policies for
440160	444780	the printers. Hopefully they have multifactor in general, and also for the printer fax servers.
444780	451560	They're probably using fax over IP over PSTN fax, T38 over T30. City B, however, doesn't have
451560	456400	any of these things, practically. At a flat-nerve topology, you exploit the printer fax, you exploit
456400	461620	the network. They have bad patching, bad multifactor authentication implementation, and bad security
461620	470680	posture. So if you're City B, you're thinking, well, does this apply to me? How can I know?
470680	475840	Our high-level attack overview is specifically geared towards what Checkpoint Research did
475840	481960	in showing that specifically is the HP OfficeJet Pro 6830 online printer. However, it wasn't the
481960	485540	printer that had the vulnerability, it was HP's implementation of the JPEG parser, if you
485540	491560	remember. So HP released a security bulletin in July 2018 talking about this, providing patches.
492140	497660	However, maybe not all of City B saw that. Maybe they didn't apply that patch, maybe they didn't
497660	503680	think to apply the patch, they're not even keeping in track with their recycled machine. These
503680	507400	sorts of things are not important to lots of cities, and they're not going to look at security
507400	513220	patches when they're available for them. So I would recommend, if you're City B, looking to see
513220	517720	if you have an HP printer. Did you buy it after 2018, before 2018? Did you apply a patch if you
517720	522120	bought it before 2018? And if you didn't, and you're using PSDN, you're probably susceptible
522120	527460	to this attack right now. NIST has some things to say about it as well. NIST says that there's
527460	532620	no widely used standard for fax encryption. Thus, information sent by fax is at risk for the
532620	537160	possible interception or modification. Jurisdictions should carefully weigh the risks of fax transmission
537160	542100	over other alternatives. So this is a big deal, and I think this is one of the biggest
542720	546500	vulnerabilities that we're seeing in fax, and the thing that we'd like to see changed most in the
546500	552840	future is the unencryption of it. And we would like to see a default encryption method used on
552840	557960	fax in the future. T38 making encryption standard rather than optional would probably
557960	562340	be a great step in that direction. They also stress the secure location of fax machines,
562340	567080	because often with T30, voting records or registration info might be actually still
567080	571680	stored on that machine as it comes through, unbeknownst to the user. So physical access
571680	578060	would allow access to all those PII. T38 and T30, we'll go over that really quickly if we haven't
578060	583180	gone enough over it already. So PSPN, that's going to be T30. It's going to be unencrypted,
583180	587880	and it's not real-time. T38 is the future that we're currently living in, but we also need to
587880	593900	see the future as far as encryption implementations. So we saw Babytel as a company, and they have an
593900	598640	AES implementation that's very useful for companies that are regulated and that are
598640	604200	mandated to use potentially unsecure networks along the way towards the delivery to the user.
604200	609140	However, this AES implementation by Babytel isn't ensuring that you will have encrypted
609140	613840	transport all the way across. So more stuff like that is what we need to see on a default level
613840	618300	in the industry, and we're not seeing right now, which is why we're talking about it and getting
618300	624780	that on the record. So fax security versus public perception. The big issue we kind of based in
624780	630300	pushback from different cities and counties was that they say that only maybe the last faxed out
630300	634300	they received was 2012, and that's eight years ago. So they don't think about it at all. It doesn't
634300	638260	cross their minds, and since they don't see it on a daily basis, they ask themselves, why do we need
638260	643860	to secure this? It doesn't seem like a security risk. But the point is, is that zero bouts need
643860	647440	to be cashed for it to be a security risk. The fact of the matter is that having your publicly
647440	653180	available city or county clerk number online, and knowing, and malicious actors knowing that that's
653180	657640	the phone number they need to have access to if they need to hone that printer, or print a fax,
657640	662220	that's all they need. And if you are not patched, if you're on a potentially vulnerable solution,
662640	666500	that's it. You're done. That printer fax is done. You're potentially putting yourself up for
666500	671740	integrity tax at the very least, confidentiality, and availability if you have bad network topology
671740	676520	solutions. So we face a lot of pushback, but we definitely need to acknowledge that that's
677020	680440	the issue, is the root of the matter, is having a publicly available phone number.
681140	685220	So let's talk about the security gap analysis as we move towards a future state. Well, what do we
685220	690440	want to see? Well, like we talked about, we want to see encryption. We want to maybe even see fax
690440	694760	no longer being a needed method for transmission. But the reality is that many industries don't
694760	699700	rely on fax. Medical is 70% of all medical transmissions. But maybe elections doesn't
699700	705480	have to be one of those industries where fax is reality. So what are we going to do in the future
705480	710500	as we continue to work on this with Secure the Vote? Well, we want to reconstruct the fax ploy,
710500	715540	but we also want to demonstrate it with the T38 fax protocol and fax over IP. Because a lot of what
715540	720520	we're seeing from cities and counties, well, we do do fax sometimes, but it's all electronically.
720720	727040	And sometimes for these city B or county B scenarios, IP just means security to them.
727040	732120	Over the internet means security. Maybe they have some sort of bias against phone lines but not IP
732120	735520	when that's not the case. And so we need to demonstrate that exploit to various election
735520	740740	officials around the country and show fax is insecure and it can be changed. And we need to
740740	745460	make sure that this is a secure place to secure our votes and to secure our democracy. So we're
745460	750960	going to continue to raise awareness about fax and security. So why now? Well, for one thing,
750960	756660	COVID-19 has made this a very interesting age and potentially could drop voter turnout as people
756660	763600	cannot come out to physical voting locations. And maybe jurisdictions will look to things
763600	768240	traditionally offered to OPAPA and offering that to the general public. So fax, the web portals,
768240	774260	the mobile voting. And we need to be very conscious when we look at adding fax to the
774260	779780	general public, because that is adding a huge attack surface. And that's adding many, you know,
779780	783880	the millions more votes that could potentially be cast by fax, even though we probably won't see
783880	788640	millions of votes cast by fax. The potential is the point. And that potential millions of votes
788640	795760	that can be changed or maliciously attacked is a very juicy target for nation states, maybe,
795760	800660	that are looking to influence it. So we need to keep that in mind as we potentially add fax in
800660	806180	for more people. So if it does get added, we need to look at it very security-minded as an emergency
806180	810520	ballot return method, not as something that everybody should think about doing over anything
810520	815760	else. Election officers should probably secure, perform security audits on their fax machines to
815760	818940	make sure, you know, potentially if you are exactly what we've been talking about, these HP
818940	823520	printers, that you bought it after 2018 and it has a security patch applied, all that good stuff.
823520	828700	Because if it's not, that's the first step of the rest that's fixing this situation. So short-term
828700	833260	recommendations. If you're a position of power, you need to talk to your IT department about these
833260	837940	things that we've been talking about. Specifically, do you have security posture like multi-factor?
837940	841900	Do you have that already strong across your IT department? And do you have that for your
841900	846400	printer fax service? Do you have a segmented network topology that will help you defend from
846400	850160	these confidentiality and availability attacks that we've been talking about? And even the
850160	854440	integrity attacks that will keep the printer fax from exploiting the rest of your election
854440	859780	network? And do you have a patching policy? Are you even security conscious about the network
860720	865000	machines that you have in your office? If you don't have these things or you don't know,
865000	868340	I would definitely recommend talking to your IT department about this and try to
868340	874420	secure your network by this fall. And in the farther future, we need to talk about how T38
874420	880020	fax over IP using encrypted solution should be the standard, the default, and what everyone is
880020	885540	using, especially in this election context. The real-time faxing for everyone so we're not storing,
885540	894200	especially unbeknownst to the users, voter records on these fax machines. And the T30 having an
894200	897700	encryption protocol would also be great because a lot of people are still going to be stuck on
897700	903840	legacy systems for various reasons. And having encryption for that would be great as well.
904100	909600	So the medical industry has actually had a little bit of a commerce towards eliminating fax. They
909600	914080	said they would do it by 2020 for one of the main providers for fax solutions for medical companies.
914080	917980	It hasn't happened yet, you know, it's been a crazy time, but they're definitely looking
917980	922220	at getting the right fax. So can we maybe eventually follow the medical industry?
922220	926820	It's a great question, something we're looking at in the future. So what's the point of all this?
926820	931640	With all of 2020's craziness leading down to the end of 2020, everything that's happened,
931640	935260	this election is going to be of tantamount importance, obviously. So we cannot let
935260	939320	this opportunity to further secure America's democracy go unspoken. That's all that we're
939320	943380	about here at Voting Village, is showing exploits, showing vulnerabilities, and saying
943940	948420	we are not securing our democracy properly if we really care. And fax is one of those things,
948420	951820	even though it's a few ballots, it's a few ballots, and those few ballots matter.
951820	957360	So at the same time, can we leverage you guys? Can we say, if you guys have a fax machine,
957360	960300	if you're interested, if you want to keep following this up, how about you hack your
960300	964300	fax machine? Post about it with hashtag hackafax, and we'll be able to see that,
964300	967860	and we'll be able to continue looking at that, and showing that to officials as we
967860	973900	go about the country for the next few years with Secure the Vote. So that's what we have.
974240	978760	I've been Caleb Gardner. I'm Forrest Adu. And we're with the National Cyber Security Center,
978760	981360	and that's a hackafax. Cool. Thanks, guys.